Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/12/2024, 19:30
General
-
Target
2024-12-25_b4dbcae732186d329770833a3c0d7b4c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b4dbcae732186d329770833a3c0d7b4c
-
SHA1
88c90b06c81b4d8e8847b12b45021f4da09f4afe
-
SHA256
3fb6bf20eb86ac0bc46d97506a27f27a6d4e2517a1175e8b4105911570f756a4
-
SHA512
d877a02f978b4bd139e3a586096ca1e6a336b467006a9f40b8c4b46b97c3c79cd38d43e32ff2faa1887182c0e71878ef9efd7ddb71655bab53fa6ef925ad5d0a
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBib+56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_b4dbcae732186d329770833a3c0d7b4c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_b4dbcae732186d329770833a3c0d7b4c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TcHlZLl.exeC:\Windows\System\TcHlZLl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PazgUaS.exeC:\Windows\System\PazgUaS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wdQixqg.exeC:\Windows\System\wdQixqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eHimghY.exeC:\Windows\System\eHimghY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IIETNzX.exeC:\Windows\System\IIETNzX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oGSOcpP.exeC:\Windows\System\oGSOcpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jFwUVak.exeC:\Windows\System\jFwUVak.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BaYVlkW.exeC:\Windows\System\BaYVlkW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LdsMDKJ.exeC:\Windows\System\LdsMDKJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yAZNhPJ.exeC:\Windows\System\yAZNhPJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TQvUuXS.exeC:\Windows\System\TQvUuXS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DovOBOs.exeC:\Windows\System\DovOBOs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlAOuqo.exeC:\Windows\System\TlAOuqo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZjCifKs.exeC:\Windows\System\ZjCifKs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ptCngpT.exeC:\Windows\System\ptCngpT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dShvaoi.exeC:\Windows\System\dShvaoi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eNGGnfp.exeC:\Windows\System\eNGGnfp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wKXynBa.exeC:\Windows\System\wKXynBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Uheqyfq.exeC:\Windows\System\Uheqyfq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ooUbnKh.exeC:\Windows\System\ooUbnKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IGKzDwE.exeC:\Windows\System\IGKzDwE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58b2292fba02ebe56f85953a4163757d9
SHA19bae5deff6d82470be0f22f6a92953421199d881
SHA256d9fe5413e07b4ca2b26cb421304e0cd2c72ef33a4b0b4c0df3c0bf0838ba9c65
SHA512e26ce21fa1e34adcaec5c798a5ce960d0465d07e22b7f022ad70f58deb0abf1b192e16feb98a3e95f80f2191973495cd0fa28f30bbbe4936902aeb4d83f0d17b
-
Filesize
5.2MB
MD521c4aa6c8116d8dc15834bbbe7e20766
SHA11e9757bcdcbdc9cfe594a2f5df00bc770026e6c9
SHA25632f282754b54d126078aa6aed3c251ff20a664c944f2f41b9cbddc8226936975
SHA51212789661a74631a38f6f8500aa57822712ef9ed67e4d458babdebfdd40de472727ecbe18bde79ec8c3f2856b208548e5303a008c854f6c83e45a63ef1a95fcdb
-
Filesize
5.2MB
MD59ff470773a094b56900113e6a977033f
SHA1cdb23d2aafd2cb25cfa740047e2b902014108f83
SHA256f6e55b58ae73010ffbcb0ed23be7d98c180ca4cd827eab505dce4da8bc03f56a
SHA51217f964325d16b7a479a7f478272a28a7de1c396a71beef0b424c405b51d9d2799f6dd04e80b1b9e64c2a43a89e8b2008d97c352d18cdc99f6e6a4a03e9e9f52c
-
Filesize
5.2MB
MD5abf9f49a6349b89325e013ea0dc1300c
SHA13015ab062f44201db7bca068ba004de26e245e97
SHA256bd9344f0e554e2dbfdc0c73c71cb8fc50a0456065b92679bebaf40516fd4a85f
SHA51210f8040139ff99c0428e18c2be5dcd3bbe2fdeca82e12aed8be305d04da7ccbe0b3c29ccfa05ecb6cd719e7f1fb5f8f7718602232c32a297a745ddf8d56fab88
-
Filesize
5.2MB
MD509cd62f368e5a12f015fec92dfa3b5cd
SHA1a8a85664cca4684dcbd9d0fe095a7e16fcb06ec4
SHA256705e9c1c0e467d380a6e3222d3fc90bcf42b3824b49f3272d06e4521e96b9cda
SHA512c613c857365e2c24b8f16dcd2afabb628aeb2f0c1c43201805f1cb87f711e65c922b2c0c3c4fb25dc994778abff1535e3b1b855bf6128bc376fc1350610d1259
-
Filesize
5.2MB
MD59901b63aa2fdd8798a902f84113d88f0
SHA1f0c9251eb08251901ab1f88153941e6d953f63ec
SHA2569aaaa392ed4ead3384c80eb7445c85e55ba945fd7ba310e4b10318362bd03ec5
SHA512a6cad96a634b79f338acdafa26808bd18488295bcc5d6bf193e4265039c7dd3d85fd1c5427b9f76b585ab60394f46b2004d5406fb91fc203b77472987f2d2ce8
-
Filesize
5.2MB
MD5309f492a5e9b04ed5268f90797241a13
SHA19dd267eb623cc1a25bc3a979c9cae6d8271a81e9
SHA25620db331aecd63e5fc245fb8a9900b5320d12b038569002379e2f6160010faede
SHA51231cd5791df89c305b66bd7b250d9fefebca8d5cd32c74325894366e0e12b53f3b9a0bb296ef83f2bcd569e9cbf0761e9f4a1799cda7dc5e11815cf091dc704ff
-
Filesize
5.2MB
MD5ad739dd19f458947978ad2f676ada008
SHA1a135b5e7e28c5e8b6cd8589d5101a76b9d59980a
SHA256141d3ce72412eb7e0c9289804acd25d7a289f053d5cf829733fcf3842840200e
SHA5127f02bb4dad823b531bcdf0df68a6fce4fb6ccb5fffad2fcb517cb63960b00d0984b3aa72b0a8d63958d8d8f5b247f2857a29810a4a8b8ee878af532bb2785fce
-
Filesize
5.2MB
MD51baa1289bb5dc3218b9921e9a066a4dd
SHA197fafc1659cfaa9908979e6506350138e3f1fd04
SHA25620349eccac657b0463dc45befdddd2632be407d251003fffa04b94328630afd6
SHA512c2de3cbd086e76b24f51aee47bc48282c8eea4d31eebf42563ed108a590176258fae7c450ba461bbcb832388cbb49c8d86437d30418b363297afffbf1ac4c4ac
-
Filesize
5.2MB
MD51c7f64099d5dfa94170e5419c1901349
SHA120a0da8a314f4264aeb4b532b9cdfc4987ecd315
SHA256523d06ad0d54d2ce8bdc52ea2dc6f89d471d6af593711370a263ab472f077e73
SHA512f66e8dbc20e1ec74bf1d76e382dbdd3eaff9093777a9262def7d3d531ac15a62a13b3dccca6d2cbf3c791be9f4db39f7b70aafaaebd6a2a6b7ca3c970328f0ee
-
Filesize
5.2MB
MD5f74952e6c8ee7538c4d5056951e7310c
SHA1f4eef2c96a9cb34b127037b43d7b1881000f5213
SHA2569c7c707fd43bd772a1be95375d48a04de2b00de51634627bb84f098758c56b73
SHA512c75cc38723d3e12f7ab8b6791862a424cd7b88afccdbb3a8b85bd3331e0db4f684a9960b5d6fa3c92e685821830a0f214ce9703e553be896a4dc2a5e733ee8a2
-
Filesize
5.2MB
MD5d8ffe955266a00577e71efcc3991eb75
SHA11ec5b718e2c2077616f08450538c74ff0464c687
SHA25619acca5e8e44954c28cba5b33d5c072e7920015c7b1625ece710595f558dac78
SHA5120ac6b89d0ef6799e79a7b2db7f062397c6d7531406c60122f1b20b2c2657c90f21a97b462cdf768a873378c21407a5188419973ead182b0d8f16230f03467a80
-
Filesize
5.2MB
MD5c8651dcd16d9bf251b79dfa7efd1a8b3
SHA101417f9ca4ede0d6a79bf4cb73d306f740bb9d8d
SHA25688600fed53c2d10ae6e38c5741d887559652d1bb23fc055db6a0812d6525ac14
SHA512bd3aeadafb3f8d9f845448e38305ffca0767ad5241f162c12ec6eb3b99aa9df79bfa1d93725b56608ef92529b7dd9a81c8b506c991f5c54f5c147bb92d2d4418
-
Filesize
5.2MB
MD54a4c5ce0396d9f76cfb1b7c45d867250
SHA15f9b8a01cd6c1790c6df8ce79ed22cfbc6354138
SHA2561aa890065ba290a2c55018c7462165a9c9af773cb3cb6b7c3d5f6720b81392db
SHA512e14843fd75b5018bf01f37b615e38cddc1ebc0afeb8233ed3cfadc0df1a58b4f7127ec92635d68c82da5eff67f70d9670cdb7a16550fe4be1a894e7295518438
-
Filesize
5.2MB
MD52ed36cc6427c8e417109d53577f779ce
SHA163a2b9405e99ff565e055d9c53a81ec571cb3598
SHA256fee60ca88e20950bcea5fd31327b8c6dd835335eb7c9f98e9fb2db81b0a0872b
SHA51299ae4674daa9aa1fce98cdda62e0f3991321af8652f43646be6c3eb63c8f708d5d1042485af374ec3437658f514b7ee5d089a32535af2580c0d84e44bbfa5524
-
Filesize
5.2MB
MD5e3db3c620b07c376d6712f84ff43da07
SHA1416c405a78449f8dc9300d7089bdd2743aa588f3
SHA2566e3c08263dffa26ec5ed10aeb1b47bfa701dfe9e1b96c4a67f78756a30bc2f31
SHA5126d46816233cb0222a64d66d6355da2d6c78f7468282a670a58850175dbb76e80a0c9800d1fdae310d895376f987803cb38899df9c7340d08a8369ceba3c72068
-
Filesize
5.2MB
MD55666e4fd52729c67069246748728c22c
SHA1664bd2e01b7844c227733993831462ca5f47635d
SHA256df291a6a640901ece827c82151310f0e5ed2d1b6ffb6fdcaad0a523f757fbb2a
SHA512eb9dc866614a1f348c1a762cde8a677247beb868cbe6526b7c306ad9176ff9a2d07d6356b1deb9e1d5381ca90828cec879847cb82312f8394668aed0e501f742
-
Filesize
5.2MB
MD5957ce18e95995615c0f339ae0bdbaf6d
SHA135f5260a150499dec32f17f3b74fd24085afa802
SHA25631321ebc31ac08e00783d78b3f3dc573b2079ee5871cd3e3dd9910f89d1ba22e
SHA512e48b3f9462e92d24e4553a74fe9826519c0e76196ffbbdb8e6c9a72543e97218ff2c2adf5ddc70462401a948ca6f505f27fa9874f50332521b74193534b47e38
-
Filesize
5.2MB
MD509e6d441506729c03815fe8f61eafcdb
SHA1bd90d48e766b20351b1ec977b3533852becaf195
SHA256397bca9ff5e27c510d65011da04a096dfb7debafe93a9621ab7381940a85c3a4
SHA512cf5eff8d40de604b5b62a0f36cf8bc69429bc5158efaecefa41662a52988beee1cdcc2e2b83b7ba93a9d752a03c986883a0d1ea65532fa28feea882485154da3
-
Filesize
5.2MB
MD52bd0ca414db6a5d81587c6eb76b672bb
SHA1a4da721499a380f0554fea01dfd5337e672f90fb
SHA2565c2098a8fd40bd69a42ca71ca54f64478efc14f22407801d8512bb4c928513c7
SHA512c683d4db51c787189221dfdcc82b36df6ab134092f2e9fb2a1ca1f12df6300a2882194d30c045df4ca4c45d19304022687b2105f7ee05b507068deaeb053a363
-
Filesize
5.2MB
MD5b6ac9fb01fbd2f8ccddc81ede150a650
SHA1d478f2c7c9179ef56808c97ae3bc98af1ac0a969
SHA2561592e6109d59234ea6bac83e0b7c089677d907bdd792d3947bd9d5dc5602f089
SHA5122343a5d8235ddce374d451edaf55e3d62863193e639cb45c82314ebbac737e417c226f70fa7a7586f37b475198220dd8b7139b9e33e6f20ae6aa2206239c3bf7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB